$1700 Bounty | Unauthenticated Command Injection Vulnerability | Bug Bounty Methodology | POC

[@sadasdasdasd-l8i]

It would be great if you could make a video explaining how you found the bug from the beginning to the end :)

[@lmaoo254]

It's a htb box, named paper, search it up if you want to know how he found the bug. Also you don't get paid ($1700) for solving a htb box

[@Noctuu]

@@lmaoo254why’d he put 1700$ bug bounty in the title then

[@tomdotsh]

I've seen plenty of people do THM / HTB rooms and claim it to be a pirvate program and get paid from it@@Noctuu

[@studiospan6426]

@@lmaoo254 i think he prolly did some domain forwarding to hide the domain name since it's a private program. he prolly used a private or public 0 day instead of fuzzing (guessing from the port)

[@shainshashaik1473]

Thank you for showing trail and error .. with your video.. i got remote shell .. thanks a lot ❤❤

[@abhishekmorla1]

Glad it helped

[@shuvokumarsaha8478]

It would be great if you could make a video explaining how you found the bug from the beginning to the end :) 2

[@dittonachan]

great bro, learning alot from you, do you have any blog or writeups, I want to start hunting too

[@abhishekmorla1]

Search my name you will get some medium writeups

[@__pain__05]

can you make a video for recon????

[@abhishekmorla1]

sure

[@shreemadav9596]

Great find 💯💪

[@playmorefunny2340]

this is crazy

[@CyberNinja-p1t]

omg, so cool

[@miteshvalvi1170]

how you find cmd parameter

[@abhishekmorla1]

Thats the recon part..you wont find in this video

[@احمدفرحان-ت7ك]

🎉🎉🎉🎉🎉

[@CyberTechwithNikhil]

It's my suggestion bro, try to add some nice hackers songs music😅, to make and and watching experience better it's my suggestion just depend upon you.

[@abhishekmorla1]

Yeah i dont have time for choosing songs bro..😅 but will start again by using some non copyright songs

[@CyberTechwithNikhil]

@@abhishekmorla1 ofcourse you can do that also

[@studiospan6426]

@@abhishekmorla1 jesus christ dude i hate those songs running in the background please don't add them 😭 looks so cheap like those russian hacktivists from hackernews. most of those videos are barely any informative so i just fast forward them and mute the sound. for example they would run wpscan then visit same endpoints manually like /wp/v2/users like isn't it supposed to be scanned by wpscan automatically? why would you waste your time they don't even know what they are doing. i started bb this year march made like a 800$ till now (am noob rn) and only 20% was from automation but most of the cheap videos you would find about hacking on KZbin would be them running some tool manually for 30-40 minutes like a skiddie dude write a script automate it why waste your time. While also wasting other's time in recon wormhole.

[@abhishekmorla1]

Ok bro ​@@studiospan6426

[@jomynn]

How to report this bug?

[@abhishekmorla1]

search for hackerone reports regarding same

[@Srocify]

what the target name ?

[@abhishekmorla1]

private program

[@Srocify]

keep going dude i hope i can be like you

[@RajuHa-g3m]

​@@abhishekmorla1how did you came to know this this is this file uploaded to rce ? How you came to this post request